[aitrawog]

Summary

candywalk.acceptedRef refused github.com/opencharly/charly outright, so the corpus could never
read charly as a source: three skills (go, go-quality, plugin) authored in charly beside the
code they document were unreachable, and a fourth (charly-version) had no authority but pod-charly-core's
retired copy (opencharly/sdk#468; opencharly/opencharly#600 §8 decides it).

The refusal is correct for the one form it was written for — @github.com/opencharly/charly/candy/<name>,
the pre-cutover IN-REPO ref that resolves to the LOCAL charly checkout's candy dir (the local FS walk
already surfaces that) and that the box submodule repos' own cutover sweeps (87a2fcd, #167,
2026-08-25) — and obsolete for the BARE repo-root form now blocked, the shape
opencharly/opencharly, spec and sdk are already pinned as, and the shape charly began authoring
its skills in on 2026-10-23 (092f82e4, charly#1047) — after the refusal existed. Keyed on
RepoPath alone, the predicate could not tell the two apart; spec.ParsedRef.SubPath already carries
the distinction.

The change is that one predicate, in the single home both readers share:

if pr.RepoPath == "" {
    return ""
}
// The pre-cutover IN-REPO charly form is still refused: … The BARE repo-root form is a CORPUS SOURCE …
if pr.RepoPath == "github.com/opencharly/charly" && pr.SubPath != "" {
    return ""
}

Per file:

• candywalk/candywalk.go — the skip narrowed to the SUBPATH form (+32/−13 in the file: 4 added
  code lines, 1 removed, the other 28 added and 12 removed lines being comments); and the three
  comments that stated the old rule corrected in the SAME change (R5): collectRefs' doc block (which
  said refs INTO charly are "skipped" full stop — it now states the subpath reason AND the repo-root
  admission), acceptedRef's own comment, and parseRemoteRef's, which claimed collectRefs "skips
  RepoPath == github.com/opencharly/charly". No comment still claims a blanket refusal.
• candywalk/candywalk_refs_charly_repo_root_test.go (new) — two arms with the control that fails:
  the collector admits the bare repo-root ref while BOTH spellings of the pre-cutover subpath form
  (versioned and versionless) stay refused beside an untouched sibling ref; and the walk-level arm —
  a refs list declaring the bare ref has the fetched ROOT manifest walked and exactly 4 skill: nodes
  unioned in with Dir: "." and the fetched tree as SourceRoot.

What this PR does NOT do, and it is deliberate: it does not run the real charly marketplace generate
— that is the CONSUMER leg (marketplace refs PR, producer-first after this merges and tags), and its
arm is the with/without-pin corpus diff. It also does not touch the local-root asymmetry measured while
deciding this (collectEntitiesWithRemote reads a repo's ROOT charly.yml only on the FETCHED path);
that is opencharly/sdk#469, filed with the measurement, not absorbed here.

How tested

Change class: Go library source in a shared kit (sdk/candywalk) — no runtime target, no image, no
candy. The repo's gate is .github/workflows/ci.yml; the changed path is additionally executed LIVE
against the REAL 225-ref marketplace refs list and the REAL charly@v2026.296.2303 tree, with an
offline resolver stub (nothing fetched, no network).

The control that fails — RED, both levels, on the unmodified source

Source at origin/main d515baf, git diff --stat candywalk/candywalk.go empty, only the new
test file present:

# source UNMODIFIED at d515baf; the test file is the only change on disk
$ cd /home/atrawog/Sync/Atrapub/mo/dsh/opencharly/.worktrees/sdk468/sdk
$ git diff --stat candywalk/candywalk.go     # (no output — the code is the pre-fix code)
$ GOTMPDIR=~/.cache/go-tmp TMPDIR=/tmp go test ./candywalk \
    -run 'TestCollectRefs_CharlyRepoRootIsACorpusSource|TestCollectEntitiesRemote_CharlyRepoRootManifestEmitsSkills' -v
--- FAIL: TestCollectRefs_CharlyRepoRootIsACorpusSource (0.00s)
    candywalk_refs_charly_repo_root_test.go:62: collectRefs DROPPED "@github.com/opencharly/charly:v2026.296.2303"
      — the bare repo-root form is a corpus SOURCE (opencharly/sdk#468) and a sibling declared ref must
      never vanish silently (opencharly/sdk#322); got [@github.com/opencharly/layer-nodejs:v2026.240.0001]
--- FAIL: TestCollectEntitiesRemote_CharlyRepoRootManifestEmitsSkills (0.00s)
    candywalk_refs_charly_repo_root_test.go:169: the bare charly repo-root ref reached the resolver 0 times,
      want exactly 1 — the corpus walk must FETCH it (opencharly/sdk#468); resolver calls: []
FAIL
rc=1

And at the generator's own entrance — the REAL refs list (marketplace origin/main 5bcd6ea,
candy/charly-marketplace/charly.yml, 225 refs) in two arms that differ by ONE added line,
'@github.com/opencharly/charly:v2026.296.2303', plus a third arm carrying the pre-cutover subpath form:

# pre-fix source (d515baf), resolver stubbed offline; the charly arm's tree is the real tag tree
== ARM without-charly ==
resolver calls: total=225 unique=225
charly refs queued: 0
entities: total=1 skills=0

== ARM with-charly ==
resolver calls: total=225 unique=225          <-- NOT ONE MORE: the pin is refused
charly refs queued: 0 -> []
entities: total=1 skills=0

0 charly entries, the same 225 keys, rc=0, no message — the silent drop the issue measured.

GREEN — the same two arms on this head

# head f0ade11 (git rev-parse HEAD); tree b110a67
$ cd /home/atrawog/Sync/Atrapub/mo/dsh/opencharly/.worktrees/sdk468/sdk
$ GOTMPDIR=~/.cache/go-tmp TMPDIR=/tmp \
    MEAS468_ROOT_NO=/tmp/sdk468/rootNo MEAS468_ROOT_YES=/tmp/sdk468/rootYes \
    MEAS468_ROOT_SUB=/tmp/sdk468/rootSub MEAS468_CHARLY_TREE=/tmp/sdk468/trees/charly-2303 \
    go test -count=1 ./candywalk -run TestMeas468Entrance -v
== ARM without-charly ==
resolver calls: total=225 unique=225
charly refs queued: 0
entities: total=1 skills=0

== ARM with-charly ==
resolver calls: total=282 unique=282
charly refs queued: 1 -> [github.com/opencharly/charly@v2026.296.2303]
entities: total=132 skills=4
  SKILL github.com/opencharly/charly:v2026.296.2303|charly-version-skill|.
  SKILL github.com/opencharly/charly:v2026.296.2303|go-quality-skill|.
  SKILL github.com/opencharly/charly:v2026.296.2303|go-skill|.
  SKILL github.com/opencharly/charly:v2026.296.2303|plugin-skill|.

== CLOSURE GROWTH (unique resolver keys present ONLY with the charly pin) ==
count=57
  of which the charly repo itself: 1 ; declared-ref twins: 56

== ARM subpath-only (the pre-cutover form, must stay REFUSED) ==
resolver calls: unique=225 ; charly refs queued: 0 ; entities: 1

The four skills, all owner=charly-skill-shelf, dir=. — the issue's four, counted from the real
tag tree. The unit arms on the same head:

$ go test ./candywalk -run 'CharlyRepoRoot' -v
--- PASS: TestCollectRefs_CharlyRepoRootIsACorpusSource (0.00s)
--- PASS: TestCollectEntitiesRemote_CharlyRepoRootManifestEmitsSkills (0.00s)
PASS

The regression guard is the subpath arm: 225 keys, 0 charly refs, entities: 1 — unchanged from the
without-charly arm. A box submodule still carrying @github.com/opencharly/charly/candy/<name> keeps
resolving it the way it does today (the local FS walk), and never through the network.

The 56-ref closure growth this admits — measured, and NOT absorbed

count=57 = the charly repo itself + 56 declared refs in its root manifest, all at OLD tags
(distro-arch:v2026.274.1256, layer-kind:v2026.274.0645, plugin-kube:v2026.276.1350 … every one a
twin of a repo this list already pins at a newer tag). Each is a distinct (repo, version) key, so a
cold run pays 56 extra shallow clones and 56 twins enter the dedupe. The mitigation that already exists
is resolve.go's direct-pin authority (preferEntity step 2: a DIRECT ref beats a closure twin), and
this PR does not take it on faith — the marketplace refs leg proves it with the with/without-pin
corpus diff, which is the arm that can fail. Named here so it is not discovered later.

The gate on the committed tree (f0ade11, tree b110a67)

$ git rev-parse HEAD; git rev-parse HEAD^{tree}; git diff --stat origin/main...HEAD
f0ade11f13cf14471453fa9b7ef7f15d615975a5
b110a674b84520c2d2cd273ec6ed1ea679ef4bdb
 candywalk/candywalk.go                            |  45 +++--
 candywalk/candywalk_refs_charly_repo_root_test.go | 199 ++++++++++++++++++++++
 2 files changed, 231 insertions(+), 13 deletions(-)
$ test -z "$(gofmt -l .)" && echo 'gofmt: clean'
gofmt: clean
$ go vet ./... && echo 'vet: clean'
vet: clean
$ go test ./...            # 19 packages ok, 1 no-test-files, 0 FAIL
ok  	github.com/opencharly/sdk	0.532s
ok  	github.com/opencharly/sdk/agentkit	0.588s
ok  	github.com/opencharly/sdk/candywalk	0.054s
ok  	github.com/opencharly/sdk/deploykit	26.357s
ok  	github.com/opencharly/sdk/kit	12.351s
ok  	github.com/opencharly/sdk/loaderkit	3.897s
… (all ok, rc=0)
$ for a in amd64 arm64 arm 386; do GOOS=linux GOARCH=$a CGO_ENABLED=0 go build ./... || echo "FAIL $a"; done
linux/amd64 rc=0
linux/arm64 rc=0
linux/arm rc=0
linux/386 rc=0
$ GOTOOLCHAIN=go1.26.8 go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.2 \
    run --allow-parallel-runners
0 issues.

golangci-lint was built and run the CI way — GOTOOLCHAIN=go1.26.8, the version ci.yml pins via
go-version-file: go.mod, and the linter at the ci.yml pin v2.13.2 — and it reports 0 issues for
the whole module. opencharly/sdk#466 (a host-built linter cannot read this module's export data) did
NOT bite here: building the linter with the module's own toolchain is exactly what avoids it. On a host
whose default toolchain is newer, GOTOOLCHAIN=go1.26.8 is the difference between a real gate and a
toolchain-skew false red.

Rulebook compliance

• R0 — loaded /charly-internals/plugin, /charly-internals/marketplace,
  /charly-internals/go, /charly-internals/git-workflow and this repo's AGENTS.md before the first
  edit; every command above was run after that.
• R1 — no finding was parked. The change's own defect is the issue (#468); the asymmetry found
  while measuring it is #469, filed with the measurement and its blast radius rather than absorbed.
  Zero warnings on the gate.
• R2 — one ref policy, one home: acceptedRef, shared by the text fallback and the declared-scalar
  reader, was already the single authority and stays it. No second predicate, no per-caller exception.
• R3 — no sleep, retry, suppression, or fallback branch; the measurement harness is a test-local
  resolver stub and touches no production code.
• R4/R5 — the doc comments that stated the old rule are corrected in this commit, including one in
  parseRemoteRef that would otherwise have described a skip the code no longer performs. The
  retracted claim was swept: grep -rn 'pr.RepoPath == "" || pr.RepoPath' candywalk/ → no match.
• R6 — git status --short read before staging; one commit, one push; no force-push, no
  --no-verify, no main push, no foreign file.
• R7 — the coverage fails without the change (both new tests red on d515baf, pasted above), and
  the changed path ran live against the real refs list and the real tag tree.
• R8 — no live service boundary: the walk is filesystem discovery, and the resolver seam is stubbed
  offline ON PURPOSE, so the measurement is deterministic and fetches nothing. The real fetch is the
  consumer leg's arm.
• R9 — no binary/runtime surface touched by this diff (no charly build, no candy, no packaging).
• R10 — no disposable: true target is affected; the change class's gate is ci.yml, run on the
  committed tree above.
• Cutover — this is one unit of a tracked multi-unit cutover (opencharly/opencharly#600): the
  producer leg. Its consumer leg (marketplace refs PR: pin + regenerated corpus, expected delta =
  authority only) follows producer-first, and the carrier pin does not move in this PR.

Change classification

Go library source (sdk/candywalk, a mechanism kit consumed by every corpus generator and by
deploykit's label+validate collector). No schema change, no wire type, no runtime target, no image.
Producer-first: sdk → tag v0.<YYYYDDD>.<HHMM> → marketplace refs PR → corpus proof.

Filed issues

• opencharly/sdk#469 — candywalk: a repo's ROOT charly.yml is read only on the FETCHED path; the
  same tag tree emits 1 entity / 0 skill nodes as --root and 132 entities / 4 skill nodes fetched
  (measured here, with its blast radius and the fix's open question). Not absorbed into this PR.

A3. This session's delivered system message reads, verbatim: You are a coding agent powered by the deepseek-v4.1-flash model. — harness DeepSeek Harness, model deepseek-v4.1-flash; cited with
opencharly/opencharly#538.

Agent: charly-sdk468

Assisted-by: DeepSeek Harness deepseek-v4.1-flash (fully tested and validated)

[github-actions]

Review — PASS

What the diff actually does

candywalk/candywalk.go narrows the charly refusal in acceptedRef from a RepoPath-only test to a RepoPath && SubPath != "" test, with an early RepoPath == "" return. That is exactly the predicate quoted in the body, and it is the single shared home both readers (text fallback + declared-scalar) already used, so no second policy path is introduced. The three comments that stated the old blanket rule (collectRefs doc block, acceptedRef, parseRemoteRef) are corrected in the same diff; the grep the body cites (pr.RepoPath == "" || pr.RepoPath) is genuinely gone from the changed lines. No dead code, no leftover legacy branch, no duplicated predicate.

Line accounting: the diff header/stat is +32/−13 for candywalk.go, which I re-derived hunk-by-hunk (13+15+4 added, 6+4+3 removed) — it matches the body. The body's "9 added code lines, 1 removed, the rest comments" is only exact if the 5 inline comment lines inside the function are counted with the 4 code lines (4 code lines strictly); that is a loose label, not a contradiction of the substance, and the aggregate numbers are right.

Tests — the control is real

candywalk_refs_charly_repo_root_test.go is a genuine regression guard, not a tautology:

• The collector arm declares the bare repo-root ref, both spellings of the pre-cutover subpath form (versioned and versionless), and an unrelated sibling. It rejects any unexpected collected ref, requires both expected refs, and length-checks. Pre-fix, repoRoot is dropped, so it fails — exactly the RED output pasted in the body (the Fatalf text in the diff matches the pasted failure verbatim).
• The walk arm asserts the resolver is hit exactly once for github.com/opencharly/charly:v2026.296.2303, and that 4 skill: nodes come back with Dir: "." and SourceRoot equal to the fetched tree. Pre-fix the ref never reaches the resolver (charlyRefs == 0) — again matching the pasted RED. The docs-sources candy fixture correctly must not perturb the count.

Crucially, both arms are behavioural: if spec.ParsedRef.SubPath were not populated as the change assumes, the subpath assertions would fail. So the crux assumption is pinned by a test that can fail, not merely asserted in prose. The live 225-ref / real-tag-tree measurement (TestMeas468Entrance) is a local harness not committed here; it is supplementary evidence and the body does not claim it ships, so its absence from the diff is not a defect.

Honesty / consistency of the body

Re-derived against the diff and it holds: 2 changed files, 199 added test lines, head f0ade11, +32/−13 in the source file, the RED messages matching the test source, and the GREEN arm's four skills (charly-version, go, go-quality, plugin) matching the test fixture. The body explicitly scopes out what it does not do — the charly marketplace generate consumer leg and the local-root asymmetry filed as #469 — and discloses the 56-ref closure growth with the existing preferEntity direct-pin mitigation rather than hiding it. That is a disclosure, not a parked defect: the defect this PR closes is #468, and #469 is filed with its measurement.

Security / scope

No secrets, no input-handling, no privilege or dependency change; pure library predicate + tests. Scope is coherent: one predicate, its comments, and its coverage. No foreign files, no runtime surface.

Comments / sign-off

There are 0 comments, so nothing to re-derive or disposition, and no maintainer sign-off is present or claimed. With no designated maintainers configured, the change stands on its own evidence — which it does (shipped red-without-change coverage + matching gate output).

Non-blocking observations

• The body's "9 added code lines" is only true if inline comments are counted as code (strictly 4 code lines added). Worth tightening for precision in a future write-up, but not a material inaccuracy.
• Admitting the bare root means a project that both has a local charly checkout as a root and pins the bare charly ref could surface the same tree under two namespaces; the body discloses the related local-root asymmetry as #469 and the dedupe authority lives in resolve.go, so this is a corpus-leg concern for the follow-up PR, not a defect in this one.

Verdict: PASS

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run

[aitrawog]

STATUS — verdict read in full and both non-blocking observations dispositioned. PASS stands; the head does NOT move (f0ade11), so no re-run is needed: neither observation is a code finding, and a re-run on a green head would only mint another same-name check run on the same SHA.

Observation 1 — the line accounting was loose. FIXED in the body (live now). You were right: my count of "9 added code lines" came from a grep -vc '^+//', which does not match the INDENTED inline comments inside the function. Re-derived exactly:

$ git diff -U0 origin/main...HEAD -- candywalk/candywalk.go | grep '^+' | grep -v '^+++' | grep -vcE '^\+\s*//'
4
$ … | grep '^-' | grep -v '^---' | grep -vcE '^-\s*//'
1

so +32/−13 = 4 added code lines + 28 added comment lines, 1 removed code line + 12 removed comment lines. The body now says exactly that. The aggregate was right; the label was not, and it is the kind of number I should have derived rather than eyeballed.

Observation 2 — the duplicate-namespace case (a local charly checkout as a root AND a bare charly pin). REBUTTED as out of this diff's scope, on the record, with what would catch it. Two reasons, both measurable:

• It is not reachable in the corpus's own configuration: marketplace generate --root <marketplace> walks THIS repo as the local root, and the marketplace repo has no charly checkout in it. The condition needs a project that is simultaneously a charly checkout and pins charly — i.e. a consumer's project, where resolve.go's preferEntity step 1 (local beats fetched) already decides in favour of the local tree, deterministically.
• The related asymmetry you name is opencharly/sdk#469 (the LOCAL root's charly.yml is never read — measured: 1 entity / 0 skill nodes local vs 132 / 4 fetched on the same tag tree), and it is the reason the duplicate CANNOT silently double-publish today: the local side contributes no skill: nodes at all. Fixing #469 is what would make this collision real, and that issue's own fix must answer it — which is why it is filed with the question rather than patched here.

The corpus leg that would show any residue is the marketplace refs PR's with/without-pin diff: zero bodies changed is the gate, and it inspects every emitted path.

A3. This session's delivered system message reads, verbatim: You are a coding agent powered by the deepseek-v4.1-flash model. — harness DeepSeek Harness, model deepseek-v4.1-flash; cited with opencharly/opencharly#538.

Agent: charly-sdk468

Assisted-by: DeepSeek Harness deepseek-v4.1-flash (analysed on a live system)